docs: close out Plan 2 — workflow engine live

docs/superpowers/followups.md

@@ -6,13 +6,3 @@ Items surfaced during review of one plan that belong to a later plan. Prevents s
 
 - **Forwarded-headers + Secure-cookie behind Traefik.** Cookie auth in Task 5 uses the ASP.NET Core default `CookieSecurePolicy.SameAsRequest`. Behind Coolify/Traefik TLS termination the app sees plain HTTP internally, so the cookie will silently be sent WITHOUT the `Secure` flag in production unless `UseForwardedHeaders` (with `ForwardedHeaders.XForwardedProto`) is added and TLS-terminating proxies are configured as `KnownProxies`/`KnownNetworks`. Wire this up when we add the Dockerfile + compose in Plan 4.
 - **Boot-time re-seed on legacy plaintext `admin.password_hash_source`.** Plan 2 Task 5 turned `admin.password_hash_source` into a secure key (AES-GCM encrypted at rest). Any DB that predates that commit stores it as plaintext, so on first boot `AdminBootstrap.Seed` → `repo.Get(PasswordSourceKey)` will try to decrypt a plaintext string and throw `CryptographicException`. For pre-launch this is fine (fresh volumes), but before Coolify goes live we should catch that specific exception in `AdminBootstrap.Seed` and treat the row as "not set" so it re-seeds cleanly on the new format.
-
-## Deferred to Plan 2 (Executor + real nodes)
-
-- **Encryption at rest for `admin_config`.** The `PasswordSourceKey` row currently stores the plaintext ADMIN_PASSWORD (documented trade-off in `AdminBootstrap.cs`). When Plan 2 introduces AES-GCM for `connections.config_json_encrypted`, extend the encryption to the sensitive `admin_config` values.
-- **`AdminConfigRepository` direct unit tests.** Currently exercised only through `AdminBootstrapTests`. Add a small Get/Set/UPSERT round-trip test.
-- **Fail-fast integer parsing** in the `Program.cs` env-var loop. Malformed values (`EXECUTION_RETENTION_DAYS=abc`) currently blow up opaquely inside `Configuration.Bind`. Add `int.TryParse` with a clear "env var X has non-integer value" message.
-- **Schema-driven `IConnectionSecretPolicy`.** Plan 1 ships `HardcodedSecretPolicy` (fixed field-name set). Plan 2 must replace with one that reads a `secretFields: ["..."]` array off each registered `IConnectionProvider.ConfigSchema`.
-- **Connections endpoint edge cases.** Currently: (a) POST with a non-object `config` value throws `InvalidOperationException` inside `StripSecrets` → 500. Should be a clean 400. (b) POST with a `(provider_id, name)` that already exists raises a raw `SqliteException` on the unique index → 500. Should be a 409 Conflict. Both are v1 stub limitations, worth handling before the SPA lands.
-- **Empty `{}` body on POST /api/workflows also returns 500.** `WorkflowsEndpoints.cs` calls `req.Graph.GetRawText()`; a default `JsonElement` (`ValueKind.Undefined`) throws `InvalidOperationException`. Same fix shape as the connections case above — guard on `ValueKind is Undefined or Null` → `Results.BadRequest`.
-- **Extend the "fail-fast env parsing" follow-up** (above) to also validate `ENCRYPTION_KEY` at the env-parse layer instead of deep inside `EncryptionKeyLoader.Load`, so bad base64 fails with a clear "env var ENCRYPTION_KEY is not valid base64" message.